docs: clarify public portfolio entry points

[saagpatel]

What

• Added a top-level README entry point for the sanitized public demo and portfolio collateral.
• Clarified that the committed deck artifact is the PDF preview, while the editable PPTX is a local gitignored rebuild output.
• Updated case study, rehearsal, portfolio, and handoff links/wording so public readers do not land on missing PPTX links.

Why

The portfolio bundle is now ready enough to be discoverable from the repo root, but the public path still had friction: the README did not point to the sanitized demo package, and several docs implied the gitignored PPTX was a committed artifact.

How

• Linked docs/demo/sanitized-demo-plan.md, docs/portfolio/README.md, and docs/demo/portfolio-handoff-bundle.md from the root README.
• Swapped direct public PPTX links to the committed deck PDF preview.
• Kept rebuild instructions for local editable deck generation, including the bundled Codex soffice fallback command.

Testing

• pnpm exec prettier --check README.md docs/portfolio/README.md docs/deck/README.md docs/deck/REHEARSAL.md docs/demo/portfolio-handoff-bundle.md docs/case-study.md
• Local markdown link existence check across touched public docs.
• Stale public PPTX-link scan.
• Sanitized boundary scans for private/company placeholders and stale device-policy examples.
• node scripts/ci/check-workstation-preflight.mjs
• node scripts/ci/check-workflow-command-drift.mjs
• node scripts/ci/check-version-parity.mjs
• pnpm health:repo

Risks

Low. Documentation-only change. The only notable behavior is expectation-setting: public docs now point to the committed PDF preview rather than the local gitignored PPTX.

Performance impact

None expected. Documentation-only change; no runtime assets, UI, API, database, or bundle logic changed.

Lockfile rationale

No lockfiles changed.

Screenshots

Not applicable. Documentation-only change; no UI surface changed.